1. Slides created by: Professor Ian G. Harris Method of Attack, Physical Access Attacker has physical possession of the device  Many devices are small and portable Assume that attacker has only external access  Short access time  Lacks knowledge about internals Attack through external interface  Normal user interface  USB, SD card interface

2. Slides created by: Professor Ian G. Harris Physical Access Attacks Attacker can do what user can do  Read numbers from a phone  Examine digital pictures, etc. USB/SD card allows large, fast data theft USB may be “bootable”  Device may automatically run code on USB key Attacker can rewrite Flash memory  Install arbitrary malware

3. Slides created by: Professor Ian G. Harris Defenses Against Physical Attacks Do not lose physical control of your device Enable password protection on the device  Can be inconvenient

4. Slides created by: Professor Ian G. Harris Intrusive Physical Attacks Attacker gains extended physical access to the device Attacker knows about the design of the device Attacker opens the device and accesses internal signals  Requires unusual sophistication  Normal users do not need to worry

5. Slides created by: Professor Ian G. Harris Reading Internal Signals Attacker can view data transferred between ICs Intellectual property (songs, videos, etc.) Secret keys, etc. CPURAM Logic Analyzer

6. Slides created by: Professor Ian G. Harris Reading Internal Signals, Defenses Encrypt all data in transit between ICs  Expensive and time consuming Make device tamper-proof  Very expensive Use internal board layers for routing  Layers can be sanded down  Epoxy over ICs to hide part numbers  Epoxy is removable

7. Slides created by: Professor Ian G. Harris Reprogramming FLASH Memory Attacker can reprogram the entire device though its JTAG interface CPU Flash JTAG

8. Slides created by: Professor Ian G. Harris Reprogramming FLASH Defenses Make flash unprogrammable  Blow an internal fuse  Updates become impossible Require secret key to access JTAG  Costly

9. Slides created by: Professor Ian G. Harris “Super” Intrusive Attacks Attacker gains access to the design of the ICs inside the device Requires time, knowledge, and access Only large organizations could launch this type of attack

10. Slides created by: Professor Ian G. Harris Hardware Trojans Attacker modifies IC design before fabrication Spy at the design and/or fabrication site IC includes altered functionality CPUASIC Trojan

11. Slides created by: Professor Ian G. Harris Side-Channel Attacks Examine “information leakage” via power and delay analysis If key[i] == 1 then power will be higher and delay will be longer Requires precise knowledge of IC algorithm and implementation if (key[I]) then {... }

12. Slides created by: Professor Ian G. Harris IP Watermarking Attacker steals IP design and sells it as his own Need to prove that a stolen design is actually stolen Insert “markers” into the design which can be recognized later  Add extra logic that has no real function Markers must not be apparent to the attacker

13. Slides created by: Professor Ian G. Harris ATmega Assembly a = b + c; lw $r1, ($s1) lw $r2, ($s2) add $r3, $r2, $r1 sw $r3, ($s3) Load b from memory Load c from memory Add b and c Store result a in memory 10010001000000110000001000000001 add$r3$r2$r1 Compiler Assembler

14. Slides created by: Professor Ian G. Harris Assembly Instructions  Assembly instructions are a readable mnemonic for machine instructions  One-to-one mapping from assembly instructions to machine instructions Except macros ADD R0, R1 0000110000000001

15. Slides created by: Professor Ian G. Harris ATmega Instruction Formats  16-bit machine instructions  6-bit opcode  2 5-bit register arguments (32 registers)  Direct Register Addressing mode used ADD instruction  Rd <- Rd + Rr OOOO11RDDDDDRRRR

16. Slides created by: Professor Ian G. Harris Instruction Format, 1 register  4-bit opcode  1 4-bit register argument (only 16 registers)  8-bit constant ANDI instruction  Rd <- Rd && K 0111KKKKDDDDKKKK

17. Slides created by: Professor Ian G. Harris Instruction Format, 1 register  11-bit opcode  1 5-bit register argument ASR (arithmetic shift right) instruction  Rd > 1 1001010DDDDD0101

18. Slides created by: Professor Ian G. Harris Instruction Format, Branch  Assumes that comparison (sub) already performed  9-bit opcode  11 constant, PC offset addressing  Branch distance is limited BREQ (branch if equal) instruction  Z == 1 then PC <- PC + K + 1 111100KKKKKKK001

19. Slides created by: Professor Ian G. Harris Assembly Code Structure An input line may take one of the four following forms: 1. [label:] directive [operands] [Comment] 2. [label:] instruction [operands] [Comment] 3. Comment 4. Empty line  Label is an alias for a line of code Used for jumps/branches

20. Slides created by: Professor Ian G. Harris Example Assembly Program label:.EQU var1=100 ; Set var1 to 100 (Directive).EQU var2=200 ; Set var2 to 200 test: rjmp test ; Infinite loop (Instruction) ; Pure comment line .EQU assigns a string to a constant  Semicolon (;) sets off comments

21. Slides created by: Professor Ian G. Harris Some Arithmetic Operations  Some instructions take immediate (constant) arguments  Some instructions use carry from previous operations

22. Slides created by: Professor Ian G. Harris Some Logical Operations  Logical operations are bitwise  Some instructions take only one argument

23. Slides created by: Professor Ian G. Harris Accessing Registers/Memory  All registers are memory mapped  Special instructions are used to access non-register memory

24. Slides created by: Professor Ian G. Harris General Purpose Registers  General-purpose registers are written using: LDI - Load Immediate LDI R16, 0xFFR16 <- 0xFF MOV - Copy Register MOV R0, R1 R0 <- R1 SBR - Set Bits in Register SBR R0, 0xFFR0 <- R0 | 0xFF CBR - Clear Bits in Register CBR R0, 0xAA R0 <- R0 & (0xFF - 0xAA)

25. Slides created by: Professor Ian G. Harris LDI Instruction LDI Rd, K  8-bits for the immediate, K  4-bits for the register, Rd  Can only access 16 registers (R16 - R31)  SBR and CBR have the same limitation

26. Slides created by: Professor Ian G. Harris MOV Instruction MOV Rd, Rr  5-bits for each register, can access all registers  Can move from high regs to low regs

27. Slides created by: Professor Ian G. Harris I/O Registers  I/O registers are written/read using: IN - In Port IN R0, PORTB R0 <- PINB OUT - Out Port OUT R0, PORTB PORTB <- R0 SBI - Set Bit in I/O Register SBI PORTB, 3PORTB <- PORTB | 1<<3 CBI - Clear Bits in I/O Register CBI PORTB, 3 PORTB <- PORTB & !(1<<3)

28. Slides created by: Professor Ian G. Harris SBI Instruction SBI A, b  5 bits specify register, 3 bits specify bit to set

29. Slides created by: Professor Ian G. Harris Addressing SRAM (Ext. I/O) Instructions are 16-bits long SRAM addresses are 16-bits long Address cannot fit in the instruction Memory addresses are stored in special-purpose registers X, Y, and Z registers are each 2 bytes LD, ST instructions are used to access SRAM

30. Slides created by: Professor Ian G. Harris Data Indirect Addressing LDI XH HIGH(0x01A8) LDI XL HIGH(0x01A8) LD R0, X ST X, R0 Registers X, Y, and Z can be used to address SRAM XH (YH, ZH) and XL (YL, ZL) are low and high bytes

31. Slides created by: Professor Ian G. Harris Branching  PC typically advances by 2 after each instruction Instructions are 2 bytes long  Branching changes the PC counter to a new location  Unconditional Branches always occur  Conditional Branches occur only if a condition is true  Needed to implement conditional control flow (if, then) and loops (while, for, etc.)  Labels are used to name branch destination

32. Slides created by: Professor Ian G. Harris Unconditional Branching JMP k  32-bit instruction  Need 22-bits to address 4M memory space  Assembler substitutes label with address

33. Slides created by: Professor Ian G. Harris Relative Jump (RJMP) RJMP k  Only 16-bit instruction, address is 12 bits long (4K range)  PC relative addressing used Destination is PC + k + 1  Restricted to close jumps (+/- 2K)  Not usually a problem (especially on small processors)

34. Slides created by: Professor Ian G. Harris Conditional Branches  Branch occurs is appropriate condition is satisfied  Conditions depend on results of previous arithmetic operations ADD R0, R1 BRVS dest. dest:ADD R2, R3  BRVS is Branch is Overflow is Set  Branch occurs if previous addition resulted in overflow

35. Slides created by: Professor Ian G. Harris Status Register (SREG)  Bit 5 – H: Half Carry Flag  Bit 4 – S: Sign Bit, S = N ⊕ V  Bit 3 – V: Two’s Complement Overflow Flag  Bit 2 – N: Negative Flag  Bit 1 – Z: Zero Flag  Bit 0 – C: Carry Flag  SREG contains information about the results of arithmetic/logic operations

36. Slides created by: Professor Ian G. Harris Conditional Branch Instructions  Test indicates the relationship between operands  Boolean shows values in SREG

37. Slides created by: Professor Ian G. Harris Branch Conditions  SREG must be set before conditional branch instruction  C code example: if x < y then x++; else y++;  Assume x is in R0 and y is in R1 CP R0, R1 BRLT then else:INC R1 RJMP done then:INC R0 done:…  Compare operation, CP, used to set SREG Does not affect other regs

38. Slides created by: Professor Ian G. Harris Skip Instructions  “Skip” instructions skip the next instruction if a condition is satisfied  Can be used as a mini conditional branch  SBRC - Skip if bit in register is cleared (0) SBRS R0, 0 INC R0  Rounds R0 up to nearest even number

39. Slides created by: Professor Ian G. Harris Subroutines  RCALL k calls a subroutine starting at label k PC + 1 is pushed onto the stack  RET returns from a subroutine PC is popped off of the stack  No other calling procedures are followed Registers are not pushed/popped Arguments are not pushed/popped No local vars allocated on stack

40. Slides created by: Professor Ian G. Harris Using the Stack  PUSH Rd places contents of Rd on the stack  Decrements stack pointer (SP)  POP Rd places contents of stack in Rd Increments (SP)  SP must be initialized to top of SRAM, RAMEND LDI R0, LOW(RAMEND) OUT SPL, R0 LDI R0, HIGH(RAMEND) OUT SPH, R0

41. Slides created by: Professor Ian G. Harris Assembler Directives  Assembler directives give commands to the assembler  Do not generate machine code instructions.DSEG var1:.byte 1 var2:.byte 2.CSEG ldi XL, LOW(var1) ldi XH, HIGH(var1) ld R0, X .DSEG declares data segment Placed in SRAM .CSEG declares code segment Placed in FLASH .BYTE allocates space Only in data segment

42. Slides created by: Professor Ian G. Harris EEPROM Segment.ESEG eeconsts:.db 0xff, 0x11.CSEG fconsts:.dw 0xffff .ESEG declares initialized data in EEPROM .DB declares a data byte in program memory (CSEG) or EEPROM (ESEG) .DW declares a word (16-bits) in CSEG or ESEG

43. Slides created by: Professor Ian G. Harris Other Assembler Directives.DEF =R  Define a symbol to refer to a register  Ex..DEF i=R9  Placement in file should precede first use .UNDEF undefines the symbol.EQU =  Define a constant to refer to a constant value  Ex..EQU ZERO = 0  Constant cannot be redefined or undefined.SET =  Same as.EQU except variables can be changed later